1. 978-1-4799-2439-4/13/$31.00 © 2013 118
User Behaviour Classification using Fuzzy Rule Based System
1,2
Atta-ur-Rahman 1
Dur-e-Najaf Zaidi 3
Muhammad Hamad Salam 1
Shahid Jamil
1
Barani Institute of Information Technology, PMAS-Arid Agriculture University, Rawalpindi, Pakistan
2
Institute of signals, systems and softcomputing (ISSS), Islamabad, Pakistan
3
The University of Lahore, Islamabad Campus, Islamabad, Pakistan
ataurahman@biit.edu.pk najaf@biit.edu.pk hamad.salam@yahoo.com shahid@biit.edu.pk
Abstract— In this paper a novel technique for user behavior
classification is proposed using Fuzzy Rule Based System
(FRBS). Using this technique a network user can be monitored
and his/her behavior can be classified depending on his/her
activities like unauthorized websites usage, attempting to
breach in network security, firewalls, unauthorized services
access and frequency of attempts etc. The information about a
user is obtained by his/her web, database, hardware and other
applications logs. FRBS classifies a user to one of the
predefined categories based on the information extracted from
user logs. This would great help in network security and
privacy as well as users may be guided for sincere mistakes
and other measures may be taken by the organization.
Significance of the proposed scheme is shown by examples and
results.
Keywords-component; Behaviour Classification, Fuzzy Rule
Base System; Web-mining
I. INTRODUCTION
User monitoring and behavior prediction is necessity of
every computer network especially in those organizations
where classified data is processed. Every user in the
network is given some rights and privileges and at the same
time he is restricted from certain tasks. For example, there
are many companies that do not allow users to upload the
data by any mean like using file transfer protocol (FTP),
emails etc. Though the monitoring systems are already
deployed that do not let a user to do the restricted things but
this is where the proposed system takes the responsibility.
Proposed system focuses on the users that try to attempt the
restricted tasks on and off, which reveals the tendency of a
user for doing intentional mistakes. Proposed system
assesses the user and predicts his/her behavior depending
upon his/her history of network usage and classifies him/her
to one of the predefined categories.
In [1], author has investigated various techniques for
behavioral evaluation and discussed their suitability for E-
learner behavior evaluation. It was shown by the results that
fuzzy classification techniques were better than crisp
classification methods. Moreover, it was shown that
Kernelized Fuzzy C-mean (KFCM) Clustering is better than
simple Fuzzy C-Mean (FCM) technique.
In [2], authors presented a technique for run-time user
classification based on rating behavior. This was carried out
by using Jiminy [3] [4], a scalable distributed architecture for
providing participating incentive in online rating scheme.
Jiminy is based on an incentive model where participants are
explicitly rewarded for submitting ratings, and are debited
when they query a participating reputation management
system (RMS)
In [5] a neuro fuzzy reasoner is used to model the
behavior of students. The fuzzy model successfully handles
reasoning with imprecise information and enables
representation of student modeling in linguistic form the
same way human teachers can do. The students’
classification can be based on activity evaluation.
Classification can be easily expressed in terms of fuzzy
logic. Some test cases and rules were developed to classify
the students. According to student performance in tests the
teacher changes their teaching strategies.
Online teacher profiling system (OTPS) for secondary
school provides effectiveness and efficiency to the
education information management [6]. This system helps
the school itself to evaluate the information of a teacher’s
performance and its available profile. It helps in making
decision of teacher’s allocation process. According to
profiles teachers should be posted at respective school. So,
management decided that which teacher is better with which
class or subject.
In [7], the authors focused on the techniques incorporated
during last decade (1999-2009) and on student modeling as
it seems to be one of the latest research trends and in the
same time one of the most significant and challenging tasks
for an instructor, let alone for an intelligent tutoring system.
Ma and Zhou [8] [9] implemented a fuzzy set approach in
order to assess the outcomes of learning process. In this
paper fuzzy set principles were applied to the determination
of the assessment criteria and the corresponding weights and
finally students’ performance was evaluated on a fuzzy
grading scale according to the selected criteria.
Atta-ur-Rahman [10], proposed a teacher assessment and
profiling system (TAPS) using a fuzzy rule based system
(FRBS) and apriori algorithm [11]. In this paper, FRBS was
used to assess the user while Apriori algorithm was used as
profiling technique.
Martinez et al. [12] investigated the role of soft-
computing techniques for modeling user behavior in a
hypermedia user-adaptive system. In [13], authors proposed
an effective prediction of web user behavior with user level
models. Tyagi et al. [14] proposed a user behavior
prediction technique using correlation rules. A correlation
rule is measured not only by its support and confidence but
also by the correlation between item-sets.
In [15], Chittraa et al. proposed fuzzy equivalent matrix
technique for discovering the pattern of user’s web
navigation. This knowledge was used for user webpage

2. 1192013 13th International Conference on Hybrid Intelligent Systems (HIS)
personalization, monitoring user’s behavior and various
other purposes.
In this paper, a fuzzy rule based system is proposed for a
network user’s behavior classification. The proposed
scheme makes use of the users’ various logs like web,
machine and network logs to classify him/her behaviorally.
Simulation results are presented to signify the effectiveness
of proposed scheme.
Rest of the paper is organized as follows. System model
is given in section 2; section 3 contains a brief introduction
of Fuzzy Rule Base System designed for user classification;
simulation results are given in section 4; while section 5
concludes the paper.
II. SYSTEM MODEL
The system model considered for the research is an
institute where there are a number of computer labs for
different purposes like research, development etc. All labs
are part of a single local area network and there are different
categories of users like students, developers, researchers and
outsourced persons. Each user has given different roles and
he/she is authorized for certain tasks and restricted from
certain activities. Schematic of the proposed system is shown
in fig-1.
Figure 1. Schematic of the proposed system model
There are a number of servers, while the users’ logs from
all servers are collected on a monitoring server. Monitoring
server enlists all users’ logs for a predefined period then logs
may be cleared.
Monitoring sever will provide the user logs that are
comprize of three types that are web logs, network logs and
machine logs. This information is parsed and frequencies of
different logs are calculated in the next phase. This
information is fed to normalization block which provides
normalized frequencies of each type. This information will
be provided to fuzzy rule based system (FRBS) which will
classify the user based on the input normalized frequencies
obatined from logs.
III. PROPOSED FUZZY RULE BASE SYSTEM
Fuzzy logic is recommended for the situations that are
vague, ambiguous, noisy or missing certain information.
This section highlights the mechanism for creation of
FRBS. Steps for creation of the system are given below.
A. Obtaining Facts
All the logs are obtained from monitoring server. Logs
of all network users are stored at the said server in log-
files. These logs are of following categories.
• Web logs
• Network logs
• Machine logs
B. Parser and noise removal block
The log files are in the form of text files. This block
removes the noise words and unnecessary information
and calculates the frequencies of each log type that are
namely web frequency, network frequency and machine
frequency.
1
0
M
f m mm
W fω
−
=
= ∑ (1)
Here M is number of website categories being
monitored, say email, chat messenger, social network
sites and entertainment etc. Where mω and mf are weight
assigned to each type of website and frequency of usage
of that type. Here the weighing factor mω whose value
is between 0 and 1 that reflects the severity of the act,
where 1 represent most and zero represent least severe
act. Similarly, the network log frequencies may be
expressed as;
1
0
N
f n nn
N fω
−
=
= ∑ (2)
Here N is number of network activities being monitored,
say FTP, shared folders, user area etc. Where nω and
nf are weight assigned to each network category and
frequency of access to that category. Similarly, the
machine log frequencies may be expressed as;
1
0
P
f p pp
M fω
−
=
= ∑ (3)
User Category
Monitoring Server with
user’s web, Network
and Machine Logs
Log Parser and
Frequency Calculator of
web, network and
Machine Logs
Normalizing Frequencies
Fuzzy Rule Based System

3. 120 2013 13th International Conference on Hybrid Intelligent Systems (HIS)
Here P is number of machine activities being monitored,
say flash or pen drives attachment, disk I/O, killing
processes etc. Where pω and pf are weight assigned to
each machine log category and frequency of access to
that category.
C. Normalizing Frequencies
The frequencies of each type may be very large in
quantity so there is a need of normalization. Following
normalization activity will be performed to normalize
frequency of each type. Normalization is subject to the
total categories in that type and the maximum frequency
in that type. So the new frequencies are NfW , NfN and
NfM web, network and machine normalized frequencies
respectively.
These are given by the following equations.
1
0
1
max( )
M
Nf m mm
m
W f
Mx f
ω
−
=
= ∑ (4)
where M is total number of categories being monitored
and max ( mf ) is the maximum frequency among all
types. Similarly,
1
0
1
max( )
N
Nf n nn
n
N f
Mx f
ω
−
=
= ∑ (5)
where N is total number of categories being monitored
and max ( nf ) is the maximum frequency among all
types.
1
0
1
max( )
P
Nf p pp
p
M f
Px f
ω
−
=
= ∑ (6)
where P is total number of categories being monitored
and max ( pf ) is the maximum frequency among all
types. This is done to make the frequency factor between
0 and 1, so that the inputs become compatible with the
input format of the proposed fuzzy rule based system. It
is explained in next
D. The Fuzzy Rule Based System
There are three input variables to the fuzzy rule based
system namely, web normalized frequency (WNF),
network normalized frequency (NNF) and machine
normalized frequency (MNF). There is one output
variable named ‘user tendency’ to attempt the restricted
actions. This input output relationship is shown in fig-2.
The ranges of input and output variables fall between 0
and 1.
There are five fuzzy membership functions in each
input output variable namely very low, low, medium,
high and very high. These fuzzy variables are shown in
fig-3 to fig-6, where fig-3, fig-4 and fig-5 correspond to
input variables while fig-6 corresponds to output
variable.
As total number of rules in the rule based is the
product of membership functions in each input variable,
so there are one hundred and twenty-five rules in the
rule base. These rules are formulated on the basis of
maximum likelihood criteria. The rule format is given
below.
IF ((WNF= “vLow”)
AND (MNF= “Medium”)
AND (NNF = “vHigh”))
THEN (userTendency= “Medium”)
The rule base is shown in fig-7. There are there input
variables, whose values can be provided in the text
boxes or through the slider and according value of
output variable can be seen.
Rule surface can be seen in fig-8. This shows that as
input frequencies go higher, user tendency become
higher and vice versa. In this diagram tendency is shown
as a function of web normalized frequency and network
normalized frequency, while machine normalized
frequency was kept constant at the middle.
Figure 2. Fuzzy System Input Output relationship
Figure 3. First input variable “Normalized Web Frequency”
Figure 4. Second input variable “Normalized Network Frequency”

4. 1212013 13th International Conference on Hybrid Intelligent Systems (HIS)
Figure 5. Third input variable “Normalized Machine Frequency”
Figure 6. Output variable “User Tendency”
Figure 7. Fuzzy Rulebase
E. Components of Fuzzy Rule Base System
FRBS is implemented in standard fuzzy system toolbox
of MATLAB 7.8.0. Following is the detail of components
used in design of FRBS.
i. Fuzzifier
Standard Gaussian fuzzifier is used with AND as
MIN and OR as MAX.
ii. Inference Engine
Standard Mamdani Inference Engine (MIE) is used
that will infer which input pair will be mapped on to
which output point.
iii. De-Fuzzifier
Standard Center Average Defuzzifier (CAD) is used
for defuzzification due to its simplicity of
implementation and adequacy for real time
applications.
Figure 8. Rule surface in terms of web and network usage
Figure 9. Rule surface in terms of machine and web usage
F. Behaviour Classes
After obtaining the users’ tendency that is a scalar
between 0 and 1 (0 represents least tendency and 1
shown high tendency) from the FRBS, following classes
are defined.
TABLE I. USER BEHAVIOR CLASSES
Class No. User Tendency Class Title
1 Very Low Very Good
2 Low Good
3 Medium Fair
4 High Bad
5 Very High Very bad

5. 122 2013 13th International Conference on Hybrid Intelligent Systems (HIS)
IV. RESULTS
In order to justify the performance of the proposed
scheme, data of random users is taken from an institutional
web and data servers where there are a number of users
from various fields are having accounts and accordingly
privileges and restrictions applied. Data of five random
users is given in table-1 with their individual frequencies of
web, network and machine activities observed over the year
on monthly basis.
Table-3 shows behavior classes of different users in
different months according to their individual logs and the
obtained frequencies according to table-1.
TABLE II. USERS’ REFINED LOGS
Month User-1 User-2 User-3 User-4 User-5
Jan 10
0.0357
0.0318
0.0975
0.0344
0.4387
0.3816
0.9649
0.9595
0.9706
0.0344
0.4387
0.3816
0.0357
0.0318
0.0462
Feb 10
0.0462
0.0971
0.1270
0.6948
0.3171
0.9502
0.9572
0.9058
0.9575
0.5472
0.1386
0.1493
0.0462
0.0971
0.0318
Mar 10
0.1419
0.1576
0.1712
0.7655
0.7952
0.1869
0.9134
0.8491
0.9340
0.3404
0.5853
0.2238
0.0971
0.0462
0.0318
Apr 10
0.2785
0.4218
0.2769
0.4898
0.4456
0.6463
0.8147
0.7577
0.9157
0.6797
0.6551
0.1626
0.0462
0.0452
0.0449
May 10
0.3922
0.4854
0.6557
0.7094
0.7547
0.2760
0.7922
0.6555
0.8235
0.4898
0.4456
0.6463
0.0871
0.0229
0.0431
Jun 10
0.6787
0.5469
0.7431
0.6797
0.6551
0.1626
0.7060
0.6324
0.8003
0.1190
0.4984
0.9597
0.0551
0.0899
0.0543
Jul 10
0.7060
0.6324
0.8003
0.1190
0.4984
0.9597
0.6787
0.5469
0.7431
0.2575
0.8407
0.2543
0.0671
0.0462
0.0518
Aug 10
0.7922
0.6555
0.8235
0.3404
0.5853
0.2238
0.3922
0.4854
0.6557
0.7513
0.2551
0.5060
0.0871
0.0492
0.0368
Sep 10
0.8147
0.7577
0.9157
0.7513
0.2551
0.5060
0.2785
0.4218
0.2769
0.7094
0.7547
0.2760
0.0344
0.0021
0.0091
Oct 10
0.9134
0.8491
0.9340
0.6991
0.8909
0.9593
0.1419
0.1576
0.1712
0.7655
0.7952
0.1869
0.0044
0.0021
0.0091
Nov 10
0.9572
0.9058
0.9575
0.5472
0.1386
0.1493
0.0462
0.0971
0.1270
0.6948
0.3171
0.9502
0.0054
0.0041
0.0091
Dec 10
0.9649
0.9595
0.9706
0.2575
0.8407
0.2543
0.0357
0.0318
0.0975
0.6991
0.8909
0.9593
0.0544
0.0021
0.0791
TABLE III. RANDOM USERS’ CLASSES
User Month Behavior
1 January Good
2 November Fair
3 April Bad
4 December Bad
5 October Very good
Fig-10 shows behavior of five random users on monthly
basis. The monthly behavior is a reflection of table-II
entries. Each user’s frequencies are given in this table then
the users tendencies are plotted in the graph. One can easily
get users trend on monthly basis. Like fourth user’s trend
shows that he/she becoming better over the months. Fifth
user’s overall behavior is moderate over the year. Second
user’s behavior is random while first and third user’s trend
shows that they are becoming worse over the time.
Fig-11 shows a single user’s individual logs based
frequencies and then the composite behavior trend over the
year based on those logs.
Figure 10. Different users’ behavior over a year
Figure 11. Different users’ behavior over a year
V. CONCLUSIONS
In this paper a novel technique for user behavior
classification is proposed using a Fuzzy Rule Based System.

6. 1232013 13th International Conference on Hybrid Intelligent Systems (HIS)
FRBS classifies a user on the basis of his/her different usage
logs like web usage logs, network usage logs and machine
usage logs. These logs are obtained from a central server
and necessary processing the individual frequencies of
usage are obtained, that are fed in to the FRBS for
classification. From the simulation results it is deduced that
proposed scheme has a great potential to classify the users.
In future, hybrid intelligent techniques may be investigated
for fine tuning of the proposed scheme.
REFERENCES
[1] Hogo M.A., “Evaluaion of E-learners Behariour using Different
Fuzzy Clustering Models: A Comparative Study”, International
Journal of Computer Science and Information Security (IJCSIS), vol.
7 (2), pp. 131-140, 2010.
[2] Kotsovinos E., Zerfos P., Piratla N.M., Cameron N., “Using Jiminy
for Run-time user Classifcation based on Rating Behavior”, LNCS,
pp. 454-457, 2006.
[3] A. Fernandes, E. Kotsovinos, S. Ostring, and B. Dragovic.
“Pinocchio: Incentives for honest participation in distributed trust
management.” In Proc. 2nd Intl Conf. on Trust Management (iTrust
2004), Mar. 2004.
[4] E. Kotsovinos, P. Zerfos, N. Piratla, N. Cameron, and S. Agarwal.
“Jiminy: A Scalable Incentive-Based Architecture for Improving
Rating Quality.” In Proc. 4th Intl. Conf. on Trust Mgmt (iTrust ’06),
May 2006.
[5] Z. Sevarac, “Neuro Fuzzy Reasoner for Student Modeling.” In:
Proceedings of the 6th
International Conference on Advanced
Learning Technologies, pp. 740–744, 2006.
[6] Tzouveli, P., P. Mylonas and S. Kollias “An intelligent e-Learning
system based on learner profiling and learning resources adaptation.”
May 2007.
[7] A. S. Drigas, Argyri K., and Vrettaros J. “Decade Review (1999-
2009): Artificial IntelligenceTechniques in Student Modeling”.
Institute of informatics and telecommunications. Greece.
[8] Ma, J. “Group decision support system for assessment of problem-
based learning.” IEEE Trans. Educ. Vol. 39, 388–393, 1996.
[9] Zhou, D., Ma, J., Kwok, R.C.W., Tian, Q.,”Group decision support
system for project assessment based on fuzzy set theory.” Presented
at the Proc. 32nd Hawaii Int. Conf. System Sciences (HICSS-32),
Honolulu, HI, January 1999.
[10] Atta-ur-rahman “Teacher Assessment and Profiling using Fuzzy Rule
based System and Apriori Algorithm”, International Journal of
Computer Applications (IJCA), Vol. 65(5), pp. 22-28, March 2013.
[11] Agrawal, R and Srikant. “Fast Algorithm for Mining Association
Rule.” Proc. of the 20th Int'l Conference on Very Large Databases,
Santiago, Chile, Sept. 1994
[12] E. Frias-Martinez, G. Magoulas, S. Chen1, R. Macredie, “Modeling
user behavior in user-adaptive systems: Recent advances using Soft-
computing techniques.” Expert Systems with Applications. 29(2), pp.
1-9, 2005.
[13] Dembczy´ nski K., Kotłowski W., “Effective Prediction of Web user
Behavior with user-level Models.”, Fundamenta Informaticae, IOS
Press, pp. 1-8, 2008.
[14] N.K. Tyagi , A.K. Solanki, “Prediction of user behavior through
Correlation Rules.”, International Journal of Advanced Computer
Science and Applications (IJACSA), vol. 2(9), pp. 77-81, 2011.
[15] V. Chittraa, A. S. Thanamani, “Fuzzy Equivalent matrix for
Disovering Pattern of Web users Navigation.” International Journal
of Advanced Research in Computer Science and Software
Engineering (IJARCSSE), vol. 2 (12), pp. 290-295, 2012.